CentOS monitoring traffic on port

network-monitoringporttraffic

I am looking for a tool to monitor traffic on some ports of a CentOS server.
On this server each service runs on a port from 3000 to 3050 and I would like to compare traffic consumption on these services; like which is the main talker/listener.

/proc/net/dev only give the global amount of bits send and received on the network interface, and not at port level.

Every tool I have found out goofing google provide report on interface level (such like eth0) and none at port level, but I may have not searched enough after all.

Do you guys know any way to do such thing?

Best Answer

Or you could use targetless iptables, which is quite legal and harmless:

iptables -A INPUT -p tcp --dport 3000
iptables -A INPUT -p tcp --dport 3001
...
iptables -A INPUT -p tcp --dport 3050

and 

iptables -A OUTPUT -p tcp --sport 3000
iptables -A OUTPUT -p tcp --sport 3001
...
iptables -A OUTPUT -p tcp --sport 3050

Since none of these rules has a target, none of them will change the traffic flow. But each of them will increment its packet and byte counts for each matching packet, so iptables -L -n -v should return something like

15733  933K           tcp  --  * *      0.0.0.0/0      0.0.0.0/0     tcp dpt:3000
5733   133K           tcp  --  * *      0.0.0.0/0      0.0.0.0/0     tcp dpt:3001
...

Note this assumes you aren't using any firewalling right now; if you are, these rules will need to go in the right place in the INPUT and OUTPUT chains, ie, first.

Given the number of ports you're monitoring, you might want to delegate this to a user-defined chain to keep your iptables output sane; but that's an exercise for you!

Related Topic